FreeBSD ports tree https://cgit-dev.freebsd.org/ports/atom?h=2016Q3 2016-08-24T14:30:47Z 2016-08-24T14:30:47Z Mark Felder feld@FreeBSD.org 2016-08-24T14:30:47Z urn:sha1:29de818549a8b4350d60c0a7176c4129fe47d6f8 The PostgreSQL Global Development Group has released an update to all supported versions of our database system, including 9.5.4, 9.4.9, 9.3.14, 9.2.18 and 9.1.23. This release fixes two security issues. It also patches a number of other bugs reported over the last three months. Users who rely on security isolation between database users should update as soon as possible. Other users should plan to update at the next convenient downtime. If you are using the ICU patch, please consult UPDATING. Improve periodic cleanup, suggested by claudius (at) ambtec.de. [1] PR: 210941 [1] Security: CVE-2016-5423, CVE-2016-5424 Approved by: ports-secteam (with hat) 2016-06-17T23:28:04Z Mathieu Arnold mat@FreeBSD.org 2016-06-17T23:28:04Z urn:sha1:1a8a092d9fefcbd7f960c82c59802c61807867a6 While there, run make makepatch on affected ports, and rename patches accordingly. Sponsored by: Absolight 2016-05-19T11:09:14Z Dmitry Marakasov amdmi3@FreeBSD.org 2016-05-19T11:09:14Z urn:sha1:e87a8bd319cefd3a75d9d061fe9ac6bad980b0db Approved by: portmgr blanket 2016-02-13T22:42:04Z Palle Girgensohn girgen@FreeBSD.org 2016-02-13T22:42:04Z urn:sha1:70a06c4f2e2e669f6795dcec5165c0ea83f94e3b Security Fixes for Regular Expressions, PL/Java This release closes security hole CVE-2016-0773, an issue with regular expression (regex) parsing. Prior code allowed users to pass in expressions which included out-of-range Unicode characters, triggering a backend crash. This issue is critical for PostgreSQL systems with untrusted users or which generate regexes based on user input. The update also fixes CVE-2016-0766, a privilege escalation issue for users of PL/Java. Certain custom configuration settings (GUCS) for PL/Java will now be modifiable only by the database superuser URL: http://www.postgresql.org/about/news/1644/ Security: CVE-2016-0773, CVE-2016-0766 2014-08-02T07:01:53Z Marcus von Appen mva@FreeBSD.org 2014-08-02T07:01:53Z urn:sha1:a38c83387472ce2eefa04e133b4ac3c1fd8c3240 Exp-run: 192242, 192244 2014-07-30T18:21:47Z Chris Rees crees@FreeBSD.org 2014-07-30T18:21:47Z urn:sha1:421b8a5f6eb19e46c05ad3aa2b47126dea7afea4 uuid-ossp patch has been outdated with irrelevant changes (for us), so massage back in. In head of postgresql, this is handled properly, so eventually the ossp patches can go. 2014-03-21T08:15:26Z Palle Girgensohn girgen@FreeBSD.org 2014-03-21T08:15:26Z urn:sha1:9b588a49ffbc9a4e0bf5324b301c1f1295bb3cc0 the ossp library present, and then we never use it. 2014-03-20T13:43:15Z Palle Girgensohn girgen@FreeBSD.org 2014-03-20T13:43:15Z urn:sha1:4082f0b6dba043fe86d64e243da1aa668a9d4622 version of the database system, including versions 9.3.4, 9.2.8, 9.1.13, 9.0.17, and 8.4.21. This minor release fixes a data corruption issue with replication and crash recovery in version 9.3, as well as several other minor issues in all versions. All users of version 9.3 are urged to update their installations at the next possible downtime. Users of older versions should update at their convenience. The data corruption issue in PostgreSQL 9.3 affects binary replication standbys, servers being recovered from point-in-time-recovery backup, and standalone servers which recover from a system crash. The bug causes unrecoverable index corruption during recovery due to incorrect replay of row locking operations. This can then cause query results to be inconsistent depending on whether or not an index is used, and eventually lead to primary key violations and similar issues. For this reason, users are encouraged to replace each of their standby databases with a new base backup after applying the update. See release notes for more changes. URL: http://www.postgresql.org/docs/current/static/release.html URL: https://wiki.postgresql.org/wiki/20140320UpdateIssues A change specific to the FreeBSD port: Modify the contrib/uuid-ossp to actually work (not crashing the backend) by using the libc implementation of uuid instead of the ossp port. Schemas and queries will just work. Based on the work of Andrew Gierth. 9.1+ EXTENSION support added by girgen@. URL: http://pgfoundry.org/projects/uuid-freebsd PR: ports/121745, ports/182846 2012-06-04T11:00:52Z Palle Girgensohn girgen@FreeBSD.org 2012-06-04T11:00:52Z urn:sha1:3d2b0e285a074ae100671923ddf0e98f6a765488 active branches of the PostgreSQL database system, including versions 9.1.4, 9.0.8, 8.4.12 and 8.3.19. Users of the crypt(text, text) function with DES encryption in the optional pg_crypto module should upgrade their installations immediately, if you have'nt already updated since the port was patched on May 30. All other database administrators are urged to upgrade your version of PostgreSQL at the next scheduled downtime. URL: http://www.postgresql.org/about/news/1398/ Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2143 Fix incorrect password transformation in contrib/pgcrypto’s DES crypt() function This was fixed in a patch release for the FreeBSD ports on May 30. Security: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2655 Ignore SECURITY DEFINER and SET attributes for a procedural language’s call handle 2012-05-30T22:26:15Z Jason Helfman jgh@FreeBSD.org 2012-05-30T22:26:15Z urn:sha1:8efd38a2acd90422d224e1fa1d4f626f7860bf65 http://www.postgresql.org/about/news/1397/ With hat: pgsql